https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16727#M155 <P>My concern with filesystems is that some handle large number of files better then others. Splunk can end up creating insane numbers of files when you get to holding several TB worth of logs in the raw dirs. EXT3 is the OS default of course but I would not mind knowing if people have hit limitations with it.</P> Fri, 02 Jul 2010 21:34:39 GMT zscgeek 2010-07-02T21:34:39Z https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16725#M153 <P>What filesystem is recommended for maximum performance on centos/redhat 5.x? (64 bit) </P> <P>We were thinking either EXT3 or XFS as they are what we have used the most but wanted to get the official splunk recommendation. This will be for our indexing servers that will be doing high volume indexing and searching and storing data for long periods of time. </P> <P>Overall hardware config will be:</P> <UL> <LI>2x Quad Core Intel CPU (L5410) </LI> <LI>16GB Ram</LI> <LI>16x1TB SATA drives (7200 rpm) in an eSAS chassis.</LI> <LI>LSI RAID 5 or 10 depending on performance </LI> </UL> Fri, 02 Jul 2010 05:34:29 GMT https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16725#M153 zscgeek 2010-07-02T05:34:29Z https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16726#M154 <P>Raid 10 is supposed to have the best performance, and I've heard that recommended from several sources. I'm not sure the filesystem makes as significant a difference as long as its supported (someone please correct me if I'm wrong.).</P> <P><A href="http://www.splunk.com/wiki/Community:HardwareTuningFactors" rel="nofollow">http://www.splunk.com/wiki/Community:HardwareTuningFactors</A></P> Fri, 02 Jul 2010 06:04:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16726#M154 Jeremiah 2010-07-02T06:04:43Z https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16727#M155 <P>My concern with filesystems is that some handle large number of files better then others. Splunk can end up creating insane numbers of files when you get to holding several TB worth of logs in the raw dirs. EXT3 is the OS default of course but I would not mind knowing if people have hit limitations with it.</P> Fri, 02 Jul 2010 21:34:39 GMT https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16727#M155 zscgeek 2010-07-02T21:34:39Z https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16728#M156 <P>I use XFS for my primary splunk partition ($SPLUNK_HOME/), and then I use ext3 for the $SPLUNK_HOME/var/run partition (so that all the search jobs and temporary files that splunk creates doesn't cause fragmentation issues with the actual indexing process). (There is one minor bug with <CODE>outputlookup</CODE> because of my separate partitions, which has been reported and should be fixed soon.) I've also got all my partitions on top of LVM for easy partition reallocation.</P> Mon, 28 Sep 2020 09:14:31 GMT https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16728#M156 Lowell 2020-09-28T09:14:31Z https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16729#M157 <P>Is it absolutely necessary to do it this way if we're thinking about going with XFS on an Indexer?</P> Thu, 29 Oct 2015 18:28:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/Recommended-filesystem-for-Centos-Redhat/m-p/16729#M157 mcluver 2015-10-29T18:28:45Z